platform engineering · regulated EU financial services

Vid Košir

Senior OpenShift & Kubernetes Platform Engineer

I don't choose my hardware. I declare my needs.

I design and run OpenShift and Kubernetes platforms in regulated EU financial services — the kind of environment where “it works on my cluster” isn't good enough, and where an auditor eventually asks who changed what, when, and with whose sign-off.

Right now I'm leading a multi-wave migration of a large application portfolio onto on-premises OpenShift, on vSphere via user-provisioned infrastructure — owning the stack end to end: cluster architecture, the CI → registry → GitOps delivery path, least-privilege identity for internal teams and external vendors, storage, and secrets. I treat GitOps with ArgoCD as both a delivery mechanism and an audit trail, right-size against real utilisation rather than what workloads reserve, and model platform cost across multi-year subscription terms rather than committing capacity to workloads that don't exist yet. The tools below came out of that work.

Selected work

Open-source tools, each built from a real problem on the platform — not demos.

Linux · Security audit maintained

Linux Fleet Audit

Agentless auditing for Linux fleets. One read-only SSH pass per host produces a single formatted Excel report: full inventory, hardening findings ranked by severity with a recommended fix for each, and ~30 CIS-style pass/fail checks. Parallel, key- or password-based, and graceful — unreachable hosts are logged with a reason and the run carries on. Report cells are written formula-safe so a compromised host can't smuggle a payload into your spreadsheet.

Python MIT

GitHub

Linux · Remediation maintained

Linux Fleet Harden

Interactive, human-approved remediation driven by a Linux Fleet Audit plan. It re-verifies each finding on the live host, applies only the fixes you approve, backs up every file first, and supports full rollback. Its sshd guard — validate, watchdog, fresh-session check — makes it structurally impossible to lock yourself out. Dry-run by default; disruptive changes require a typed confirmation.

Python Apache-2.0

GitHub

OpenShift · FinOps maintained

corepair

Size OpenShift subscriptions from measured demand — and show how much of a multi-year “saving” is an enforceable contract term versus just a forecast.

$pipx install corepair

Python Apache-2.0

GitHub PyPI

Kubernetes · Storage maintained

pvdoctor

Diagnoses Kubernetes PersistentVolumes stuck in Terminating, Released, or Failed, identifies the real backend cause (orphaned vSphere snapshots, stale claimRefs, dangling volume attachments, backup finalizers, and more), and prints the safe fix next to the destructive finalizer-removal hack it talks you out of. Read-only by construction, a single static binary, with offline triage from JSON dumps.

Go Apache-2.0

GitHub Releases

Writing

Short, practical write-ups that come out of the tools above.

Why removing a PV finalizer strands your disk — and what to do instead Read What a three-year OpenShift subscription “saving” is actually made of Read Hardening a Linux fleet over SSH without locking yourself out Read